7

This question is related to How to recover deleted files? but it is slightly different in nature.

Suppose I have a file named ~/something open in a text editor. Further suppose that I open a terminal and run the following command while the file is still open in the text editor:

rm ~/something

This will delete the file. Now suppose that I changed my mind and wanted to get the file back. The file is still open in the text editor, so it hasn't been removed from the disk or filesystem yet.

Is there any way to recover it?

Community
  • 1
Nathan Osman
  • 32,155
  • 1
    If the file is still open in the text editor, you could just modify it a li'l and save it, that way you are prompted and you can save it or use "save as". Just a thought. – Nitin Venkatesh Nov 06 '12 at 23:18
  • 3
    Yeah, the question is very interesting but the example is not good - for one thing, I don't think a text editor keeps the file open (as in "low-level file handle") while the text is displayed in the editor. More likely it's open-read-close when loading, then open-write-close when saving. And, as @nitstorm said, you can just use Save As function.

    Maybe playing a video file in a video player is a better example...

     – Sergey Nov 06 '12 at 23:27
  • @Sergey: You're right - it probably wasn't a very good example. – Nathan Osman Nov 07 '12 at 00:16

2 Answers2

9

I don't know whether there are any text editors which keep the file opened while you are editing it. Normally (i.e. in Emacs), the file is read into a buffer in RAM and then the file is closed. You edit only in RAM. When you save the buffer, the file is opened, written, and closed again. You can use ps auxw | grep your_editor to find the PID of your editor, then lsof -p your_PID to see the files that are still open.

On the other hand, if the file is still in the buffer of your editor, you can just save it.

But that was not your question, so let's pretend you are using cat as your editor, and the file is really still open:

% cat >the_file.txt
Hello world!
^Z
zsh: suspended  cat > the_file.txt
% rm the_file.txt 
% ls -l the_file.txt
ls: cannot access the_file.txt: No such file or directory

You can use lsof -n to see all opened files and grep to search for your filename.

% lsof -n | grep the_file.txt
cat  2145  elmicha  1w  REG  9,1  13 108003357 /home/elmicha/tmp/the_file.txt (deleted)

In the second column you can see the PID of your cat command. You can change into the corresponding directory in the /proc filesystem, and into the fd (file descriptor) subdirectory:

% cd /proc/2145/fd
% ls -l
total 0
lrwx------ 1 elmicha elmicha 64 2012-11-07 00:22 0 -> /dev/pts/4
l-wx------ 1 elmicha elmicha 64 2012-11-07 00:22 1 -> /home/elmicha/tmp/the_file.txt (deleted)
lr-x------ 1 elmicha elmicha 64 2012-11-07 00:22 15 -> /proc/4501/auxv
lrwx------ 1 elmicha elmicha 64 2012-11-07 00:22 2 -> /dev/pts/4

Now you can just copy the "file" 1 to another file:

% cp 1 ~/tmp/the_old_file.txt

And see, it's there:

% cat ~/tmp/the_old_file.txt
Hello world!
elmicha
  • 9,728
0

Just save the file in the texteditor. Should work very well.

By the way, often you are prompted with a »leave unsaved?« message, when you still have the file open in an editor and try to close the window, because the texteditor also takes notice that the file was deleted and is currently »unsaved« (at least in that location).

(nitstorm, please don't use the comments for answers ;)

wolfv
  • 580